Resolve Okta Agentless Desktop Single Sign-On 400 Errors
Last Updated:
Overview
Users encounter a 400 error during authentication via Agentless Desktop Single Sign-On (ADSSO). This issue occurs when the Kerberos token size exceeds Okta's processing capacity. Resolve this issue by determining the size of the user's Kerberos token and reducing it to a size that Okta can process.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Agentless Desktop Single Sign-On (ADSSO)
- Active Directory (AD)
Cause
A Kerberos token becomes oversized for various reasons, with group membership and SIDHistory being the most common causes. SIDHistory increases the token size beyond Okta's 16 KB limit when administrators migrate a user object from one domain to another.
Solution
What resolves the 400 error during Agentless Desktop Single Sign-On?
Agentless Desktop SSO fails to function if the user's Kerberos token exceeds 16 KB. This size corresponds roughly to membership in 600 security groups, though this does not represent a hard limit, and many factors contribute to the token size. A user who exceeds this limit while attempting the Agentless Desktop SSO flow receives a 400 response, and Okta redirects them to the standard sign-in page.
Resolve the 400 error by modifying the user object in Active Directory to reduce the group membership count or remove the SIDHistory.
- Reduce the user's group membership count in Active Directory.
- Remove the SIDHistory from the user object in Active Directory.
NOTE: Expanding the MaxTokenSize in the Active Directory environment does not enable Okta to process a larger Kerberos token.
